Opus reviewer 3 caught a crash path: when a lockfile is unreadable
(chmod 000, permission denied, is-a-directory, broken pipe, etc.)
the audit script bubbles up a raw Python traceback and exits 1 with
no Finding emitted. In CI, a transient permission or encoding error
is indistinguishable from a malicious lockfile -- the maintainer reads
the log and sees noise, not a structured diagnosis.
Wraps both path.read_text() calls (npm and cargo branches) in a
try/except OSError that appends a new Finding kind
"unreadable-lockfile" with the original errno detail, mirroring how
missing-lockfile is handled today. Backward compatible (additive);
all 24 existing audit fixtures still pass.
Verified by fixture: chmod 000 on a lockfile -> exit 1 with
[unreadable-lockfile] finding, no traceback.
1f397f45df